1 /* 2 * Copyright 2017-2020 NXP 3 * Copyright 2022 Leica Geosystems AG 4 * 5 * SPDX-License-Identifier: BSD-3-Clause 6 */ 7 8 #include <common/runtime_svc.h> 9 #include <imx_sip_svc.h> 10 11 #define HAB_CID_ATF U(2) /* TF-A Caller ID */ 12 13 /* HAB Status definitions */ 14 enum hab_status { 15 HAB_STS_ANY = 0x00, /* Match any status in report_event() */ 16 HAB_FAILURE = 0x33, /* Operation failed */ 17 HAB_WARNING = 0x69, /* Operation completed with warning */ 18 HAB_SUCCESS = 0xf0 /* Operation completed successfully */ 19 }; 20 21 /* HAB Configuration definitions */ 22 enum hab_config { 23 HAB_CFG_RETURN = 0x33, /* Field Return IC */ 24 HAB_CFG_OPEN = 0xf0, /* Non-secure IC */ 25 HAB_CFG_CLOSED = 0xcc /* Secure IC */ 26 }; 27 28 /* HAB State definitions */ 29 enum hab_state { 30 HAB_STATE_INITIAL = 0x33, /* Initializing state (transitory) */ 31 HAB_STATE_CHECK = 0x55, /* Check state (non-secure) */ 32 HAB_STATE_NONSECURE = 0x66, /* Non-secure state */ 33 HAB_STATE_TRUSTED = 0x99, /* Trusted state */ 34 HAB_STATE_SECURE = 0xaa, /* Secure state */ 35 HAB_STATE_FAIL_SOFT = 0xcc, /* Soft fail state */ 36 HAB_STATE_FAIL_HARD = 0xff, /* Hard fail state (terminal) */ 37 HAB_STATE_NONE = 0xf0 /* No security state machine */ 38 }; 39 40 /* HAB Verification Target definitions */ 41 enum hab_target { 42 HAB_TGT_MEMORY = 0x0f, /* Check memory allowed list */ 43 HAB_TGT_PERIPHERAL = 0xf0, /* Check peripheral allowed list */ 44 HAB_TGT_ANY = 0x55 /* Check memory & peripheral allowed list */ 45 }; 46 47 /* Authenticate Image Loader Callback prototype */ 48 typedef enum hab_status hab_loader_callback_f_t(void **, size_t *, const void *); 49 50 /* 51 * HAB Rom VectorTable (RVT) structure. 52 * This table provides function pointers into the HAB library in ROM for 53 * use by post-ROM boot sequence components. 54 * Functions are ordered in the structure below based on the offsets in ROM 55 * image, and shall not be changed! 56 * Details on API allocation offsets and function description could be 57 * found in following documents from NXP: 58 * - High Assurance Boot Version 4 Application Programming Interface 59 * Reference Manual (available in CST package) 60 * - HABv4 RVT Guidelines and Recommendations (AN12263) 61 */ 62 struct hab_rvt_api { 63 uint64_t hdr; 64 enum hab_status (*entry)(void); 65 enum hab_status (*exit)(void); 66 enum hab_status (*check_target)(enum hab_target type, const void *start, size_t bytes); 67 void* (*authenticate_image)(uint8_t cid, long ivt_offset, void **start, 68 size_t *bytes, hab_loader_callback_f_t loader); 69 enum hab_status (*run_dcd)(const uint8_t *dcd); 70 enum hab_status (*run_csf)(const uint8_t *csf, uint8_t cid, uint32_t srkmask); 71 enum hab_status (*assert)(long type, const void *data, uint32_t count); 72 enum hab_status (*report_event)(enum hab_status status, uint32_t index, 73 uint8_t *event, size_t *bytes); 74 enum hab_status (*report_status)(enum hab_config *config, enum hab_state *state); 75 void (*failsafe)(void); 76 void* (*authenticate_image_no_dcd)(uint8_t cid, long ivt_offset, void **start, 77 size_t *bytes, hab_loader_callback_f_t loader); 78 uint32_t (*get_version)(void); 79 enum hab_status (*authenticate_container)(uint8_t cid, long ivt_offset, void **start, 80 size_t *bytes, hab_loader_callback_f_t loader, uint32_t srkmask, int skip_dcd); 81 }; 82 83 struct hab_rvt_api *g_hab_rvt_api = (struct hab_rvt_api *)HAB_RVT_BASE; 84 85 /******************************************************************************* 86 * Handler for servicing HAB SMC calls 87 ******************************************************************************/ 88 int imx_hab_handler(uint32_t smc_fid, 89 u_register_t x1, 90 u_register_t x2, 91 u_register_t x3, 92 u_register_t x4) 93 { 94 switch (x1) { 95 case IMX_SIP_HAB_ENTRY: 96 return g_hab_rvt_api->entry(); 97 case IMX_SIP_HAB_EXIT: 98 return g_hab_rvt_api->exit(); 99 case IMX_SIP_HAB_CHECK_TARGET: 100 return g_hab_rvt_api->check_target((enum hab_target)x2, 101 (const void *)x3, (size_t)x4); 102 case IMX_SIP_HAB_AUTH_IMG: 103 return (unsigned long)g_hab_rvt_api->authenticate_image(HAB_CID_ATF, 104 x2, (void **)x3, (size_t *)x4, NULL); 105 case IMX_SIP_HAB_REPORT_EVENT: 106 return g_hab_rvt_api->report_event(HAB_FAILURE, 107 (uint32_t)x2, (uint8_t *)x3, (size_t *)x4); 108 case IMX_SIP_HAB_REPORT_STATUS: 109 return g_hab_rvt_api->report_status((enum hab_config *)x2, 110 (enum hab_state *)x3); 111 case IMX_SIP_HAB_FAILSAFE: 112 g_hab_rvt_api->failsafe(); 113 break; 114 case IMX_SIP_HAB_AUTH_IMG_NO_DCD: 115 return (unsigned long)g_hab_rvt_api->authenticate_image_no_dcd( 116 HAB_CID_ATF, x2, (void **)x3, (size_t *)x4, NULL); 117 case IMX_SIP_HAB_GET_VERSION: 118 return g_hab_rvt_api->get_version(); 119 default: 120 return SMC_UNK; 121 }; 122 123 return SMC_OK; 124 } 125